CVEvulnerability

CVE-2009-0047

5.0 MEDIUM Published 2009-01-07 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2009-01-07
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-287, CWE-310

Description

Gale 0.99 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.

Affected configurations

• gale gale (<= 0.99) • gale gale 0.15 • gale gale 0.15b • gale gale 0.15c • gale gale 0.16 • gale gale 0.16a • gale gale 0.17 • gale gale 0.17a • gale gale 0.18 • gale gale 0.18b • gale gale 0.18c • gale gale 0.19 • gale gale 0.19a • gale gale 0.19b • gale gale 0.20a • gale gale 0.21 • gale gale 0.90a • gale gale 0.90b • gale gale 0.90c • gale gale 0.91 • gale gale 0.91a • gale gale 0.91b

Related

Weakness · not in database (1)

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References